fix: build tools (gcc, g++) in runtime image

[dmzoneill]

200MB attack surface. Move to multi-stage build, keep runtime minimal.

[github-actions]

Based on the issue description mentioning "build tools (gcc, g++)" and "200MB attack surface", this appears to be about a C/C++ project that needs a multi-stage Docker build. Since the repository isn't fully available in this environment, I'll provide a comprehensive solution that addresses the security concern.

Solution: Multi-Stage Docker Build

The issue is that build tools (gcc, g++, make, etc.) are included in the runtime image, adding ~200MB of unnecessary attack surface. Here's how to fix it:

Current Problem

Your Dockerfile likely looks something like:

FROM ubuntu:latest
RUN apt-get update && apt-get install -y gcc g++ make
COPY . /app
WORKDIR /app
RUN make
CMD ["./your-app"]

This keeps all build tools in the final image.

Multi-Stage Build Solution

Create a Dockerfile with separate build and runtime stages:

# Stage 1: Build stage
FROM ubuntu:22.04 AS builder

# Install build dependencies
RUN apt-get update && apt-get install -y \
    gcc \
    g++ \
    make \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /build
COPY . .

# Compile the application
RUN make

# Stage 2: Runtime stage (minimal)
FROM ubuntu:22.04

# Install only runtime dependencies (if any)
# RUN apt-get update && apt-get install -y libssl3 && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Copy only the compiled binary from builder
COPY --from=builder /build/your-binary /app/

# Run as non-root user
RUN useradd -m -u 1000 appuser && \
    chown -R appuser:appuser /app
USER appuser

CMD ["./your-binary"]

Key Security Improvements

1. Build tools removed: gcc, g++, make only in builder stage (~200MB saved)
2. Smaller attack surface: Runtime image contains only the binary
3. Non-root user: Application runs as unprivileged user
4. Clean apt cache: rm -rf /var/lib/apt/lists/* reduces image size
5. Minimal base: Consider FROM scratch or FROM alpine for even smaller runtime

Alternative: Distroless/Scratch Base

For maximum security and minimal size:

# Build stage
FROM ubuntu:22.04 AS builder
RUN apt-get update && apt-get install -y gcc g++ make && rm -rf /var/lib/apt/lists/*
WORKDIR /build
COPY . .
RUN make

# Runtime: distroless (no shell, no package manager)
FROM gcr.io/distroless/base-debian12
COPY --from=builder /build/your-binary /app/
CMD ["/app/your-binary"]

Benefits

• Security: Removes 200MB of build tools that could be exploited
• Size: Smaller images = faster deployments
• Compliance: Meets security best practices for production containers
• Performance: Less to scan, less to patch

Would you like me to create a specific Dockerfile once you share more details about your build process (CMake, Makefile, etc.)?

[dmzoneill]

Accepted tradeoff: build tools needed for GNOME extension development (make, gcc for glib-compile-schemas, native modules). Dev container by design.